Getting Data In

2 node cluster master reporting single peer to search head when there are 2 indexers

sanjeewa_fernan
Engager

Have 2 node Indexer cluster with a separate cluster master instance and separate SH instance, however when the SH is configured, it only shows 1 peer in the cluster as per attachment alt text

Why would the cluster master report as 1 peer to the SH when it has 2 peers listed in cluster configuration ?

Cluster master reports replication and search factor OK. see below

Replication factor met
Search factor met
All data is searchable
Indexing Ready YES

indexer1 893F55F8-DC7F-4378-A826-8A027763AE1D default
Searchable YES
Status Up
Bucket Count=6391

indexer2 90619A93-5668-45CB-AE9B-AE05B1ED43EC default
Searchable YES
Status Up
Bucket Count=107

0 Karma
1 Solution

sanjeewa_fernan
Engager

Hi, found out there was an issue with the Firewall rule connecting the Clustered SH, when the FW rule was opened (8080/8089) it worked 🙂

View solution in original post

0 Karma

sanjeewa_fernan
Engager

Hi, found out there was an issue with the Firewall rule connecting the Clustered SH, when the FW rule was opened (8080/8089) it worked 🙂

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Where is your Search Head pointing? To the CM or to the Indexer? In a clustered configuration, your search heads should all point to the Cluster Master. The cluster master will then distribute the list of indexers for search.

MuS
SplunkTrust
SplunkTrust

Hi @sanjeewa_fernando,

just to let you know, that I deleted the duplicate question from the moderation queue.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...